808d0b4f404f74358d845141402f37724aa5b972bae22c5c333221fd76b3d9c7

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 15:29

Target

d6770c58b1fa498fb789a0a8fc70bc32.exe
Size

55KB
MD5

d6770c58b1fa498fb789a0a8fc70bc32
SHA1

bcc580575c95316aaacc2ea5dace420ca26e3a88
SHA256

808d0b4f404f74358d845141402f37724aa5b972bae22c5c333221fd76b3d9c7
SHA512

93d33864b4b8a4e6bdd64a3da131e4cc8f984d4e51fadd239df64099857866bf8e24052e39a7a03ae8aeb5e32db406639b722716d2c956123c600e0577ac3ea3
SSDEEP

768:zIPfXOhlKoLxtCt74y/842kGiR5admgS0FX0MHu7fsf45XRkoc/NsvibQst0t1IU:4CKoLD+h/84UiRkdsMz4pR7mGvibQtIU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	2976	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3068	2976	d6770c58b1fa498fb789a0a8fc70bc32.exe	28
PID 2976 wrote to memory of 3068	2976	d6770c58b1fa498fb789a0a8fc70bc32.exe	28
PID 2976 wrote to memory of 3068	2976	d6770c58b1fa498fb789a0a8fc70bc32.exe	28
PID 2976 wrote to memory of 3068	2976	d6770c58b1fa498fb789a0a8fc70bc32.exe	28

C:\Users\Admin\AppData\Local\Temp\d6770c58b1fa498fb789a0a8fc70bc32.exe
"C:\Users\Admin\AppData\Local\Temp\d6770c58b1fa498fb789a0a8fc70bc32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 128
  2⤵
  - Program crash
  PID:3068

memory/2976-0-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2976-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download